System Configuration Analysis

System Configuration Analysis Skill

This skill provides detailed guidance for analyzing system configuration from sosreport archives, including OS information, installed packages, systemd services, and SELinux/AppArmor settings.

When to Use This Skill

Use this skill when:

• Analyzing the /sosreport:analyze command's system configuration phase
• Investigating service failures or misconfigurations
• Verifying package versions and updates
• Checking security policy settings (SELinux/AppArmor)
• Understanding system state and configuration

Prerequisites

• Sosreport archive must be extracted to a working directory
• Path to the sosreport root directory must be known
• Understanding of Linux system administration

Key Configuration Data Locations in Sosreport

1. System Information:

   • uname - Kernel version
   • etc/os-release - OS distribution and version
   • uptime - System uptime
   • proc/uptime - Uptime in seconds
   • sos_commands/release/ - Release information

2. Package Information:

   • installed-rpms - RPM packages (RHEL/Fedora/CentOS)
   • installed-debs - DEB packages (Debian/Ubuntu)
   • sos_commands/yum/ - Yum/DNF information
   • sos_commands/rpm/ - RPM database queries

3. Service Status:

   • sos_commands/systemd/systemctl_list-units - All units
   • sos_commands/systemd/systemctl_list-units_--failed - Failed units
   • sos_commands/systemd/systemctl_status_--all - Detailed service status
   • sos_commands/systemd/systemctl_list-unit-files - Unit files

4. SELinux:

   • sos_commands/selinux/sestatus - SELinux status
   • sos_commands/selinux/getenforce - Current enforcement mode
   • sos_commands/selinux/selinux-policy - Policy information
   • var/log/audit/audit.log - SELinux denials

5. AppArmor (if applicable):

   • sos_commands/apparmor/ - AppArmor configuration
   • etc/apparmor.d/ - AppArmor profiles

6. System Configuration Files:

   • etc/ - System-wide configuration
   • etc/sysctl.conf or etc/sysctl.d/ - Kernel parameters
   • etc/security/limits.conf - Resource limits

Implementation Steps

Step 1: Analyze System Information

1. Check OS version and distribution:

   if [ -f etc/os-release ]; then
     cat etc/os-release
   fi
   

2. Get kernel version:

   if [ -f uname ]; then
     cat uname
   elif [ -f proc/version ]; then
     cat proc/version
   fi
   

3. Check system uptime:

   if [ -f uptime ]; then
     cat uptime
   elif [ -f proc/uptime ]; then
     # Parse uptime from proc/uptime (seconds)
     awk '{printf "%.2f days\n", $1/86400}' proc/uptime
   fi
   

4. Extract key system details:

   • OS name and version
   • Kernel version
   • System architecture (x86_64, aarch64, etc.)
   • Uptime (days)

5. Check for outdated kernel or OS:

   • Compare kernel version with current stable
   • Note if system hasn't been rebooted in a very long time (>365 days)
   • Identify if OS version is EOL

Step 2: Analyze Installed Packages

1. List installed packages:

   # For RPM-based systems
   if [ -f installed-rpms ]; then
     cat installed-rpms
   fi
   
   # For DEB-based systems
   if [ -f installed-debs ]; then
     cat installed-debs
   fi
   

2. Extract key package versions:

   # Important system packages
   grep -E "^(kernel|systemd|glibc|openssh|openssl)" installed-rpms 2>/dev/null
   
   # Or use awk to parse package name and version
   awk '{print $1}' installed-rpms | head -20
   

3. Check for known problematic versions:

   • Security vulnerabilities (if known CVEs)
   • Buggy package versions
   • Compatibility issues

4. Identify package manager issues:

   # Check yum/dnf logs for errors
   if [ -d sos_commands/yum ]; then
     grep -i "error\|fail" sos_commands/yum/* 2>/dev/null
   fi
   

5. Count packages and categorize:

   • Total packages installed
   • Key package versions (kernel, systemd, glibc, etc.)
   • Recently updated packages (if timestamps available)

Step 3: Analyze Service Status

1. List all systemd units:

   if [ -f sos_commands/systemd/systemctl_list-units ]; then
     cat sos_commands/systemd/systemctl_list-units
   fi
   

2. Identify failed services:

   if [ -f sos_commands/systemd/systemctl_list-units_--failed ]; then
     cat sos_commands/systemd/systemctl_list-units_--failed
   elif [ -f sos_commands/systemd/systemctl_list-units ]; then
     grep "failed" sos_commands/systemd/systemctl_list-units
   fi
   

3. Check service details:

   # Parse detailed status for failed services
   if [ -f sos_commands/systemd/systemctl_status_--all ]; then
     # Extract service names and their status
     grep -E "●|Active:" sos_commands/systemd/systemctl_status_--all | head -50
   fi
   

4. Count services by state:

   # Count running, failed, inactive services
   if [ -f sos_commands/systemd/systemctl_list-units ]; then
     awk '{print $4}' sos_commands/systemd/systemctl_list-units | sort | uniq -c
   fi
   

5. Identify critical service failures:

   • System services (systemd-*, dbus, NetworkManager)
   • Application services (httpd, nginx, postgresql, etc.)
   • Custom services

6. Extract failure reasons from logs:

   # For each failed service, find related log entries
   grep -i "failed to start\|service.*failed" sos_commands/logs/journalctl_--no-pager 2>/dev/null | head -20
   

Step 4: Analyze SELinux Configuration

1. Check SELinux status:

   if [ -f sos_commands/selinux/sestatus ]; then
     cat sos_commands/selinux/sestatus
   fi
   

2. Get SELinux mode:

   if [ -f sos_commands/selinux/getenforce ]; then
     cat sos_commands/selinux/getenforce
   fi
   

3. Check for SELinux denials:

   # Look for AVC denials in audit log
   if [ -f var/log/audit/audit.log ]; then
     grep "avc.*denied" var/log/audit/audit.log | head -50
   fi
   
   # Or in journald logs
   grep -i "selinux.*denied\|avc.*denied" sos_commands/logs/journalctl_--no-pager 2>/dev/null | head -20
   

4. Parse denial information:

   • Extract denied operations (read, write, execute, etc.)
   • Identify source and target contexts
   • Note which services are affected

5. Check for SELinux booleans:

   if [ -f sos_commands/selinux/getsebool_-a ]; then
     cat sos_commands/selinux/getsebool_-a
   fi
   

6. Identify SELinux issues:

   • SELinux in permissive mode (may hide errors)
   • SELinux disabled (security concern)
   • Frequent AVC denials (policy may need adjustment)
   • Context mismatches

Step 5: Check System Configuration

1. Review kernel parameters:

   # Check sysctl settings
   if [ -f sos_commands/kernel/sysctl_-a ]; then
     cat sos_commands/kernel/sysctl_-a
   elif [ -d etc/sysctl.d ]; then
     cat etc/sysctl.d/*.conf 2>/dev/null
   fi
   

2. Check resource limits:

   if [ -f etc/security/limits.conf ]; then
     grep -v "^#\|^$" etc/security/limits.conf
   fi
   
   # Check limits.d directory
   if [ -d etc/security/limits.d ]; then
     cat etc/security/limits.d/*.conf 2>/dev/null
   fi
   

3. Review boot parameters:

   if [ -f sos_commands/boot/grub2-editenv_list ]; then
     cat sos_commands/boot/grub2-editenv_list
   elif [ -f proc/cmdline ]; then
     cat proc/cmdline
   fi
   

4. Check systemd configuration:

   # Look for systemd configuration overrides
   if [ -d etc/systemd/system ]; then
     find etc/systemd/system -name "*.conf" 2>/dev/null
   fi
   

Step 6: Generate System Configuration Summary

Create a structured summary with the following sections:

1. System Information:

   • OS name and version
   • Kernel version
   • Architecture
   • System uptime
   • Last boot time

2. Package Summary:

   • Total packages installed
   • Key package versions (kernel, systemd, glibc, openssl, openssh)
   • Known problematic packages (if any)
   • Package manager issues

3. Service Status:

   • Total services
   • Running services count
   • Failed services count
   • List of failed services with reasons
   • Critical service status

4. SELinux/AppArmor:

   • SELinux status (enabled/disabled)
   • SELinux mode (enforcing/permissive)
   • Denial count
   • Top denied operations
   • Policy recommendations

5. Configuration Issues:

   • Kernel parameter anomalies
   • Resource limit issues
   • Boot parameter problems
   • Configuration file errors

Error Handling

1. Missing configuration files:

   • Different distributions have different file locations
   • Some files may not be collected based on sosreport options
   • Document missing data in summary

2. Package manager variations:

   • Handle both RPM and DEB systems
   • Account for different package naming conventions
   • Support multiple package managers (yum, dnf, apt)

3. SELinux vs AppArmor:

   • Check which MAC system is in use
   • Analyze accordingly
   • Note if both or neither are present

4. Systemd vs init:

   • Older systems may use init instead of systemd
   • Check for both service management systems
   • Adapt analysis based on what's present

Output Format

The system configuration analysis should produce:

SYSTEM CONFIGURATION SUMMARY
============================

SYSTEM INFORMATION
------------------
OS: {os_name} {os_version}
Kernel: {kernel_version}
Architecture: {arch}
Uptime: {uptime_days} days ({last_boot_time})

Status: {OK|WARNING|CRITICAL}
Notes:
  - {system_info_note}

INSTALLED PACKAGES
------------------
Total Packages: {count}

Key Package Versions:
  kernel: {version}
  systemd: {version}
  glibc: {version}
  openssl: {version}
  openssh-server: {version}

Status: {OK|WARNING|CRITICAL}
Issues:
  - {package_issue_description}

SYSTEMD SERVICES
----------------
Total Units: {total}
Active: {active_count}
Failed: {failed_count}
Inactive: {inactive_count}

Failed Services:
  ● {service_name}.service - {description}
    Reason: {failure_reason}
    Last Failed: {timestamp}

  ● {service_name}.service - {description}
    Reason: {failure_reason}
    Last Failed: {timestamp}

Status: {OK|WARNING|CRITICAL}
Recommendations:
  - {service_recommendation}

SELINUX
-------
Status: {enabled|disabled}
Mode: {enforcing|permissive|disabled}
Policy: {policy_name}

AVC Denials: {count} denials found

Top Denied Operations:
  [{count}x] {operation} on {target} by {source}
  [{count}x] {operation} on {target} by {source}

SELinux Booleans: {count} custom settings

Status: {OK|WARNING|CRITICAL}
Issues:
  - {selinux_issue_description}

Recommendations:
  - {selinux_recommendation}

KERNEL PARAMETERS
-----------------
Key sysctl Settings:
  vm.swappiness: {value}
  net.ipv4.ip_forward: {value}
  kernel.panic: {value}

Custom Parameters: {count} custom settings found

Status: {OK|WARNING|CRITICAL}
Notes:
  - {kernel_param_note}

RESOURCE LIMITS
---------------
Custom Limits Found: {count}

{user_or_group}  {type}  {item}  {value}

Status: {OK|WARNING}
Notes:
  - {limits_note}

CRITICAL CONFIGURATION ISSUES
-----------------------------
{severity}: {issue_description}
  Evidence: {file_path}
  Impact: {impact_description}
  Recommendation: {remediation_action}

RECOMMENDATIONS
---------------
1. {actionable_recommendation}
2. {actionable_recommendation}

DATA SOURCES
------------
- OS Info: {sosreport_path}/etc/os-release
- Kernel: {sosreport_path}/uname
- Packages: {sosreport_path}/installed-rpms
- Services: {sosreport_path}/sos_commands/systemd/systemctl_list-units
- SELinux: {sosreport_path}/sos_commands/selinux/sestatus
- Audit Log: {sosreport_path}/var/log/audit/audit.log

Examples

Example 1: Failed Service Analysis

# List failed services
$ cat sos_commands/systemd/systemctl_list-units_--failed
  UNIT                    LOAD   ACTIVE SUB    DESCRIPTION
● httpd.service          loaded failed failed Apache Web Server
● postgresql.service     loaded failed failed PostgreSQL database

# Find failure reason in logs
$ grep "httpd.service" sos_commands/logs/journalctl_--no-pager | grep -i "failed\|error"
Jan 15 10:23:45 server systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE
Jan 15 10:23:45 server systemd[1]: httpd.service: Failed with result 'exit-code'
Jan 15 10:23:45 server httpd[12345]: (98)Address already in use: AH00072: make_sock: could not bind to address [::]:80

# Interpretation: httpd failed because port 80 is already in use

Example 2: SELinux Denial Analysis

# Check for AVC denials
$ grep "avc.*denied" var/log/audit/audit.log | head -5
type=AVC msg=audit(1705320245.123:456): avc: denied { write } for pid=1234 comm="httpd" name="index.html" dev="sda1" ino=789012 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:user_home_t:s0 tclass=file permissive=0

# Interpretation:
# - httpd (web server) was denied write access
# - Target file: index.html with context user_home_t
# - Issue: Web server trying to write to user home directory
# - Solution: Fix file context or move file to proper location

Example 3: Package Version Check

# Check for specific package versions
$ grep "^openssl" installed-rpms
openssl-1.1.1k-7.el8_6.x86_64
openssl-libs-1.1.1k-7.el8_6.x86_64

$ grep "^kernel" installed-rpms
kernel-4.18.0-425.el8.x86_64
kernel-4.18.0-477.el8.x86_64
kernel-core-4.18.0-425.el8.x86_64
kernel-core-4.18.0-477.el8.x86_64

# Interpretation:
# - OpenSSL version 1.1.1k (check for known CVEs)
# - Multiple kernels installed (good for rollback)
# - Current kernel is 4.18.0-477 (from uname)

Tips for Effective Analysis

1. Check service dependencies: Failed service may be due to dependency failure
2. Correlate with logs: Service failures often have detailed errors in logs
3. Verify configurations: Check service config files for syntax errors
4. Consider timing: When did service fail? Correlate with system events
5. SELinux context matters: File contexts must match policy expectations
6. Package versions: Compare with known good/bad versions
7. Uptime significance: Very long uptime may mean missed security updates

Common Configuration Patterns and Issues

1. Service dependency failure: ServiceB fails because ServiceA is not running
2. Port conflict: Service fails to bind - port already in use
3. Permission denied: Service can't access required files/directories
4. SELinux blocking: Service denied access by SELinux policy
5. Missing dependencies: Required package not installed
6. Configuration error: Syntax error in config file
7. Resource limits: Service hits ulimit (open files, processes, etc.)
8. Outdated kernel: Running kernel doesn't match installed packages

Configuration Issue Severity Classification

Issue Type	Severity	Impact
Critical service failed	High	Core functionality unavailable
Optional service failed	Low	Non-essential feature unavailable
SELinux in permissive	Warning	Reduced security, hiding issues
SELinux disabled	Critical	No mandatory access control
Kernel very outdated	High	Missing security fixes
EOL OS version	Critical	No security updates
Many AVC denials	Warning	Policy may need tuning

See Also

• Logs Analysis Skill: For detailed service failure log analysis
• Resource Analysis Skill: For resource limit issues
• Network Analysis Skill: For network service configuration